Is Liferay's SAML Service Provider Logout URL required in the Identity Provider?

Issue

• Azure's SAML Identity Provider (IdP) marks the Service Provider's (SP) Logout URL as "optional"
• However, when I remove Liferay's Logout URL from Azure's SAML configurations, Liferay users are not signed out completely from Liferay after signing out through Azure.
• Is it necessary to include Liferay's Logout URL in the Identity Provider's settings?

Environment

• DXP 7.4

Resolution

• It is necessary to either include the Logout URL or reference Liferay's SP Metadata (which includes the Logout URL) in the IdP.
• This is because the SP receives the IdP's logout request at the Logout URL to complete the logout process.

Additional Information

• Logout Process:

  1. The SP initiates the logout by sending the LogoutRequest to the IdP. This doesn’t change the SP’s session state

  2. The IdP then checks the SessionIndex provided by the SP request and sends a LogoutRequest to every other SP that is participating in that SessionIndex.

  3. Finally, the IdP sends a LogoutRequest to the SP which initiated the request.

• See SAML Authentication Process Overview: Service Provider Initiated SLO for more details.